CVE-2023-0040

Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability was the result of insufficient validation of HTTP header field values before sending them to the network. Users are vulnerable if they pass untrusted...

CVE-2023-0040: Improper Neutralization of CRLF Sequences

Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability was the result of insufficient validation of HTTP header field values before sending them to the network. Users are vulnerable if they pass untrusted...

CVE-2023-0040

CVE-2023-0040 affects Async HTTP Client prior to 1.13.2. The root cause is insufficient validation of HTTP header field values, enabling CRLF injection that can inject new HTTP header fields or requests into the data stream. Impact described in the connected documents notes that remote servers ma...

org.jboss.resteasy:abdera-atom-provider (1.1.ga), org.jboss.resteasy:async-http-servlet-3.0 (1.1.ga) +6 more potentially affected by CVE-2016-6346 via org.jboss.resteasy:resteasy-jaxrs (1.1.ga)

org.jboss.resteasy:resteasy-jaxrs MAVEN version 1.1.ga is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss.resteasy:resteasy-jaxrs and may be impacted: - org.jboss.resteasy:abdera-atom-provider 1.1.ga - org.jboss.resteasy:async-http-servlet-3.0...

com.logiclander.jaasmine:jaasmine-web (1.0.0), net.ju-n.bonita.connectors:bonita-qrcode-connector (0.2) +16 more potentially affected by CVE-2016-6346 via org.jboss.resteasy:resteasy-jaxrs (1.2.1.ga)

org.jboss.resteasy:resteasy-jaxrs MAVEN version 1.2.1.ga is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss.resteasy:resteasy-jaxrs and may be impacted: - com.logiclander.jaasmine:jaasmine-web 1.0.0 -...

org.chtijbug.drools:guvnor-jaxb-entities (5.6.2.chtijbug), org.drools:guvnor-jaxb-entities (>=5.6.0.cr1, <=5.6.0.final) +18 more potentially affected by CVE-2016-6346 via org.jboss.resteasy:resteasy-jaxrs (2.2.3.ga)

org.jboss.resteasy:resteasy-jaxrs MAVEN version 2.2.3.ga is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss.resteasy:resteasy-jaxrs and may be impacted: - org.chtijbug.drools:guvnor-jaxb-entities 5.6.2.chtijbug - org.drools:guvnor-jaxb-entities...

Insufficient Verification of Data Authenticity in Async Http Client

Async Http Client aka AHC or async-http-client before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set, which allows man-in-the-middle attackers to spoof HTTPS servers by presenting an arbitrary certificate during use of a...

Insufficient Verification of Data Authenticity in Async Http Client

main/java/com/ning/http/client/AsyncHttpClientConfig.java in Async Http Client aka AHC or async-http-client before 1.9.0 does not require a hostname match during verification of X.509 certificates, which allows man-in-the-middle attackers to spoof HTTPS servers via an arbitrary valid certificate...

GHSA-8H53-FJGG-G42G Insufficient Verification of Data Authenticity in Async Http Client

Async Http Client aka AHC or async-http-client before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set, which allows man-in-the-middle attackers to spoof HTTPS servers by presenting an arbitrary certificate during use of a...

GHSA-5C66-6H6G-6Q6M Insufficient Verification of Data Authenticity in Async Http Client

main/java/com/ning/http/client/AsyncHttpClientConfig.java in Async Http Client aka AHC or async-http-client before 1.9.0 does not require a hostname match during verification of X.509 certificates, which allows man-in-the-middle attackers to spoof HTTPS servers via an arbitrary valid certificate...

Mageia: Security Advisory (MGASA-2015-0212)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RHEL 7 : rubygem-em-http-request (RHSA-2021:0937)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2021:0937 advisory. EventMachine based, async HTTP Request client. Security Fixes: missing SSL hostname validation allows MITM CVE-2020-13482 For more details about the...

Fedora: Security Advisory for rubygem-em-http-request (FEDORA-2020-8ccd750904)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

GHSA-8HXH-R6F7-JF45 Memory exhaustion in http4s-async-http-client with large or malicious compressed responses

Impact A server we connect to with http4s-async-http-client could theoretically respond with a large or malicious compressed stream and exhaust memory in the client JVM. It does not affect http4s servers, other client backends, or clients that speak only to trusted servers. This is related to a...

Memory exhaustion in http4s-async-http-client with large or malicious compressed responses

Impact A server we connect to with http4s-async-http-client could theoretically respond with a large or malicious compressed stream and exhaust memory in the client JVM. It does not affect http4s servers, other client backends, or clients that speak only to trusted servers. This is related to a...

org.scala-steward:scala-steward-core_2.13 (>=0.6.0, <=0.7.0) potentially affected by CVE-2020-11612 via org.http4s:http4s-async-http-client_2.13 (>=0.21.4, <=0.21.7)

org.http4s:http4s-async-http-client2.13 MAVEN version =0.21.4, =0.6.0, =0.7.0 Source cves: CVE-2020-11612 Source advisory: GHSA-8HXH-R6F7-JF45...

org.scala-steward:scala-steward-core_2.13 (>=0.6.0, <=0.7.0) potentially affected by unknown CVE via org.http4s:http4s-async-http-client_2.13 (>=0.21.4, <=0.21.7)

org.http4s:http4s-async-http-client2.13 MAVEN version =0.21.4, =0.6.0, =0.7.0 Source cves: unknown CVE Source advisory: OSV:GHSA-8HXH-R6F7-JF45...

edu.gemini:gsp-core-ephemeris_2.12 (>=0.1.3, <=0.1.7), edu.gemini:gsp-core-ocs2_2.12 (>=0.1.3, <=0.1.7) +1 more potentially affected by CVE-2020-11612 via org.http4s:http4s-async-http-client_2.12 (>=0.21.0-m6, <=0.21.1)

org.http4s:http4s-async-http-client2.12 MAVEN version =0.21.0-m6, =0.1.3, =0.1.3, =0.1.7 - org.scala-steward:scala-steward-core2.12 0.5.0 Source cves: CVE-2020-11612 Source advisory: GHSA-8HXH-R6F7-JF45...

edu.gemini:gsp-core-ephemeris_2.12 (>=0.1.3, <=0.1.7), edu.gemini:gsp-core-ocs2_2.12 (>=0.1.3, <=0.1.7) +1 more potentially affected by unknown CVE via org.http4s:http4s-async-http-client_2.12 (>=0.21.0-m6, <=0.21.1)

org.http4s:http4s-async-http-client2.12 MAVEN version =0.21.0-m6, =0.1.3, =0.1.3, =0.1.7 - org.scala-steward:scala-steward-core2.12 0.5.0 Source cves: unknown CVE Source advisory: OSV:GHSA-8HXH-R6F7-JF45...

Information Disclosure

play-ws is vulnerable to information disclosure. The vulnerability exists through a regression caused by async-http-client that causes HTTP CONNECT requests set to an outbound HTTPS requests when using an authenticated proxy server...